Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:41

General

  • Target

    https://steamcommunity.chlep.pl/profiles/76561199/

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.chlep.pl/profiles/76561199/
    1⤵
      PID:4552
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4044,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      1⤵
        PID:616
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3832,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:1
        1⤵
          PID:5084
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
          1⤵
            PID:1412
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5412,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
            1⤵
              PID:2696
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5428,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
              1⤵
                PID:1636
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6060,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
                1⤵
                  PID:4416
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0x33c 0x3d4
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1868
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5856,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
                  1⤵
                    PID:772
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5840,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
                    1⤵
                      PID:1988
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5852,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
                      1⤵
                        PID:3168
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=7432,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
                        1⤵
                          PID:5132
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=7492,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
                          1⤵
                            PID:5140
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=7428,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
                            1⤵
                              PID:5148
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7720,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:8
                              1⤵
                              • Modifies registry class
                              PID:5156
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=7836,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:8
                              1⤵
                                PID:5164
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=8020,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
                                1⤵
                                  PID:5172
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=5076,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=8512 /prefetch:1
                                  1⤵
                                    PID:5500
                                  • C:\Windows\System32\CredentialUIBroker.exe
                                    "C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:5608
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=8764,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
                                    1⤵
                                      PID:6028
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                      1⤵
                                      • Enumerates system info in registry
                                      • Modifies data under HKEY_USERS
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:6124
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc9f3dceb8,0x7ffc9f3dcec4,0x7ffc9f3dced0
                                        2⤵
                                          PID:5560
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2296,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
                                          2⤵
                                            PID:5304
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
                                            2⤵
                                              PID:5312
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2340,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
                                              2⤵
                                                PID:616
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4392,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
                                                2⤵
                                                  PID:5864
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4392,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:8
                                                  2⤵
                                                    PID:5608
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=560,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
                                                    2⤵
                                                      PID:5004
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=1596 /prefetch:8
                                                      2⤵
                                                        PID:4484
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
                                                        2⤵
                                                          PID:5180
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=748,i,14069307627604366020,18421123632365173875,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3052
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"
                                                        1⤵
                                                          PID:5360

                                                        Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                                                                Filesize

                                                                2B

                                                                MD5

                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                SHA1

                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                SHA256

                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                SHA512

                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                c641ac8a1412d3b30fecbf09d68a9214

                                                                SHA1

                                                                d120735b30ff6d0eb39f729887e9191fc151fe72

                                                                SHA256

                                                                40f75e3e827099e366505444cda39f7d2be20324e502f9879495c252a5790d86

                                                                SHA512

                                                                d150e3e6b64319335f85cf960142585986b832176f4d493e4efce88a66e5880cad731691045688f4ecbaad9484543ffc0c9e52512c3d87999d50d4735783fad4

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                                                                Filesize

                                                                40B

                                                                MD5

                                                                20d4b8fa017a12a108c87f540836e250

                                                                SHA1

                                                                1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                                                                SHA256

                                                                6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                                                                SHA512

                                                                507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                Filesize

                                                                13KB

                                                                MD5

                                                                c31ee7f8770c85e4b98e1de9b571f65f

                                                                SHA1

                                                                7f9d96a133ef086d7a1a6171ca1b1d5cf11c1254

                                                                SHA256

                                                                0a9db1d7f4663494e4a3cc2fbd109344f27b7b55ffd461e6c06a4baad552e65d

                                                                SHA512

                                                                3e8aa880d79d8b86fe0319acd6cd2bdcb40d12e18fcb46d504197e8a8230b50176a833335146ab6fd24caed733b241b06c916cb7c947ca33fb7dc94d2f24c55d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                Filesize

                                                                30KB

                                                                MD5

                                                                f7f3723623557898901b361512177e0d

                                                                SHA1

                                                                b4d969a076bbd45ed55074b17512a5bc710bb00c

                                                                SHA256

                                                                272e250c4283a7f86cfcf94673ed8b2d3453fb363db4263cb34a7720ef28d707

                                                                SHA512

                                                                f4de68d991d7356689a17bcf8c95d9dea7fd6df447ba3c4d288818c983680a6aa9429d1c6f8bfb65b06e284315d127749463a356f6ef9597275eb842650d3c77

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                76KB

                                                                MD5

                                                                6ab70aa42037d9d0521d1236daf35c3f

                                                                SHA1

                                                                6ae980cabb8bd43ddd4a1b72f20cd8c724575fc0

                                                                SHA256

                                                                99e50a06ba0b740e4a7fac35462eed954f4dbce976717843938180d0a8709539

                                                                SHA512

                                                                b4feecd3d1e9a5be0ea47db9932abacbbfaadcfc00d17dfdb511f05294fefa9f8f0eba799c5905a7a7ed020ac8a3b5df6d6073ae5e61b1ef4a68c4936cb2532d

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                Filesize

                                                                76KB

                                                                MD5

                                                                dce01abafca0909ff16161e88abe31f1

                                                                SHA1

                                                                974f199322b8bea8022bb00a79a88f745541b6a7

                                                                SHA256

                                                                98e9b2441263b389cd1e75b35983f13bea1b4ed8f3ab1f520c09d2229eb80f8f

                                                                SHA512

                                                                6388bfa3a0c3d1358bcd3d016140cb7e961f499000f653d5ebe588711a88d14da373af699a9f1c7d28723547d569b170ed3e2a326f88417a4d2ebb8cf8f7f7cc